The host is installed with VideoLAN VLC Media Player before 2.2.0 and is prone to a cross site scripting vulnerability. A flaw is present in the application, which fails to handle crafted path info. Successful exploitation could allow attackers to inject arbitrary web script or HTML.